There is legal precedence to privacy violations that arise when an organization's CSIRT seizes an employee's office or personal computer for purposes of determining IU violations. What is the key expectation that an organization must consider with regard to its legal obligations?

Question

What will be an ideal response?

Answer 1

The key is whether the organization has created an expectation of privacy for the employee. In most private organizations, there is little expectation of privacy, unless one is created intentionally. However, in public organizations, especially academic institutions, there is enough ambiguity to require very specific clarification and extensive permissions before the organization should attempt a search-and-seizure. If the organization's senior management has clearly outlined when, what, how, and under which conditions the CSIRT may investigate an IU, then the organization is better prepared and protected. Making employees aware of this information means the employees are better prepared and protected, and it may serve as a deterrent to IU incidents.